Ransomware control method and device, terminal and computer readable storage medium

Abstract

According to the ransomware prevention and control method and device, the terminal and the computer readable storage medium, the method responds to the operation that target software obtains a random number, a first pseudo-random number is generated based on a pseudo-random number generation module, and the target software encrypts a target file based on a secret key generated by the first pseudo-random number; and then, a second pseudo-random number which is the same as the first pseudo-random number is generated again based on the pseudo-random number generation module, and the target file is decrypted by using the second pseudo-random number. According to the embodiment of the invention, the way of obtaining the random number by the target software is changed, and the first pseudo-random number and the second pseudo-random number generated based on the pseudo-random number generation module are both generated within the preset range, so that the target file encrypted by the key generated based on the first pseudo-random number can be cracked more easily; therefore, the technical problem that the encrypted file cannot be technically cracked due to the fact that the ransomware encrypts the file of the user is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a ransomware prevention and control method, device, terminal and computer-readable storage medium. Background Art

[0002] In recent years, with the rapid popularization of the Internet, various types of network attacks have occurred frequently. Using ransomware to attack users has become the most common and most widespread means of network attack. Ransomware encrypts user files, and the encrypted files cannot be technically cracked, thereby forcing users to pay ransom, which poses a great challenge to network security. Summary of the invention

[0003] The embodiments of the present application provide a ransomware prevention and control method, device, terminal and computer-readable storage medium, which can solve the current technical problem that it is difficult to prevent and control ransomware attacks.

[0004] In a first aspect, an embodiment of the present application provides a method for preventing and controlling ransomware, the method comprising:

[0005] In response to the operation of the target software acquiring a random number, generating a first pseudo-random number based on a pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0006] A second pseudo-random number is generated again based on the pseudo-random number generation module, and the target file is decrypted based on the second pseudo-random number, where the second pseudo-random number is the same as the first pseudo-random number.

[0007] Optionally, generating a first pseudo-random number based on a pseudo-random number generation module includes:

[0008] A first pseudo-random number is generated based on the pseudo-random number generation module using at least one of the machine code information and the time information of the running terminal of the target software.

[0009] Optionally, the generating the first pseudo-random number based on the pseudo-random number generating module using at least one of machine code information and time information of the running terminal of the target software includes:

[0010] The target number of times the target software obtains the random number is recorded, and at least one of the machine code information and the time information of the running terminal of the target software and the target number are encrypting based on the pseudo-random number generation module to generate a first pseudo-random number.

[0011] Optionally, enabling the target software to generate a key based on the first pseudo-random number and encrypting the target file based on the key includes:

[0012] So that the target software generates an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and encrypts the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

[0013] Optionally, decrypting the target file based on the second pseudo-random number includes:

[0014] The decryption private key is generated based on the second target pseudo-random number, and the target file is decrypted based on the decryption private key.

[0015] Optionally, before the operation of acquiring a random number in response to the target software, the method further includes:

[0016] Establish a software blacklist;

[0017] The operation of obtaining a random number in response to the target software includes:

[0018] If the operation of obtaining a random number is monitored, and it is determined that the software corresponding to the operation of obtaining a random number belongs to the software blacklist, the software corresponding to the operation of obtaining a random number is determined to be the target software and the operation of obtaining a random number is responded to by the target software.

[0019] Optionally, after establishing the software blacklist, the method further includes:

[0020] Create a software whitelist;

[0021] The method further comprises:

[0022] In response to the operation of the whitelist software in the software whitelist acquiring a random number, based on the target true random number generated by the random number generation module, the whitelist software performs a target operation based on the target true random number.

[0023] In a second aspect, an embodiment of the present application further provides a ransomware prevention and control device, the device comprising:

[0024] a response module, adapted to generate a first pseudo-random number based on a pseudo-random number generation module in response to an operation of the target software to obtain a random number, so that the target software generates a key based on the first pseudo-random number and encrypts a target file based on the key;

[0025] The decryption module is adapted to generate a second pseudo-random number again based on the pseudo-random number generation module, and decrypt the target file based on the second pseudo-random number, wherein the second pseudo-random number is the same as the first pseudo-random number.

[0026] Optionally, the response module is further adapted to generate a first pseudo-random number based on the pseudo-random number generation module using at least one of machine code information and time information of the running terminal of the target software.

[0027] Optionally, the response module is also suitable for recording the target number of times the target software obtains the random number, and based on the pseudo-random number generation module, encrypting at least one of the machine code information and time information of the running terminal of the target software and the target number of times to generate a first pseudo-random number.

[0028] Optionally, the response module is also suitable for enabling the target software to generate an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and to encrypt the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

[0029] Optionally, the decryption module is adapted to generate the decryption private key based on the second target pseudo-random number, and decrypt the target file based on the decryption private key.

[0030] Optionally, the ransomware prevention and control device includes a software blacklist establishment module, which is suitable for establishing a software blacklist; the response module is suitable for, if an operation of obtaining a random number is monitored, and it is determined that the software corresponding to the operation of obtaining a random number belongs to the software blacklist, determining that the software corresponding to the operation of obtaining a random number is the target software and responding to the operation of obtaining a random number by the target software.

[0031] Optionally, the ransomware prevention and control device includes a software whitelist establishment module, which is suitable for establishing a software whitelist; the ransomware prevention and control device also includes a whitelist response module, which is suitable for responding to the operation of the whitelist software in the software whitelist to obtain a random number, based on the target true random number generated by the random number generation module, so that the whitelist software performs a target operation based on the target true random number.

[0032] In a third aspect, an embodiment of the present application further provides a terminal, the terminal comprising:

[0033] Processor; and

[0034] A memory arranged to store computer executable instructions, which when executed cause the processor to perform any of the methods described above.

[0035] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, implement any of the methods described above.

[0036] The beneficial effects brought about by the technical solutions provided in some embodiments of the present application include at least:

[0037] By changing the way the target software obtains random numbers, a first pseudo-random number is generated using a pseudo-random number generation module. Here, the first pseudo-random number can be generated again by the pseudo-random number generation module, so that the target file encrypted based on the key generated by the first pseudo-random number can be more easily cracked, thereby solving the technical problem that the ransomware encrypts the user's files and makes the encrypted files impossible to crack technically. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 An exemplary system architecture diagram of a ransomware prevention and control method provided in an embodiment of the present application;

[0040] Figure 2 A flowchart of a ransomware prevention and control method provided in an embodiment of the present application;

[0041] Figure 3 A schematic diagram of obtaining a target true random number based on whitelist software in a software whitelist provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of obtaining a first pseudo-random number based on target software in a software blacklist provided in an embodiment of the present application;

[0043] Figure 5 A schematic diagram of the structure of a ransomware prevention and control device provided in an embodiment of the present application;

[0044] Figure 6 A schematic diagram of the structure of a ransomware prevention and control terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the features and advantages of the embodiments of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of them. Based on the embodiments in the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the embodiments of the present application.

[0046] With the rapid popularization of the Internet, various types of network attacks occur frequently. The ransomware threat is currently the most popular type of network security issue, which poses a great challenge to the smooth operation of enterprises and government agencies, and has become a type of risk challenge currently facing the world.

[0047] In the field of ransomware prevention and control, security vendors focus more on software interception and detection, and have done relatively little research on ransomware decryption and repair. It is generally believed that after a terminal is attacked by ransomware, if the attacker does not provide the key, the encryption key of the file encrypted by the ransomware is unpredictable due to the randomness of the encryption key, and with the security of the file encryption algorithm, such as the frequently used AES (Advanced Encryption Standard), Salsa20 (stream encryption algorithm), RC4 (Rivest Cipher 4, Lisbon Cipher 4) and other algorithms, the encryption key of the file cannot be cracked in the current environment.

[0048] In order to overcome the above technical problems, an embodiment of the present application provides a method for preventing and controlling ransomware, which generates a first pseudo-random number based on a pseudo-random number generation module in response to an operation of the target software to obtain a random number, so that the target software generates a key based on the first pseudo-random number and encrypts a target file based on the key; then, a second pseudo-random number identical to the first pseudo-random number is generated again based on the pseudo-random number generation module, and the target file is decrypted using the second pseudo-random number. The embodiment of the present application changes the way the target software obtains random numbers, and generates a first pseudo-random number using a pseudo-random number generation module. Here, the first pseudo-random number can be generated again by the pseudo-random number generation module, so that the target file encrypted by the key generated by the first pseudo-random number can be more easily cracked, thereby solving the technical problem that the ransomware encrypts the user's files and makes the encrypted files impossible to crack technically.

[0049] See also Figure 1 , Figure 1 An exemplary system architecture diagram of a ransomware prevention and control method provided in an embodiment of the present application.

[0050] like Figure 1As shown, the system architecture may include a terminal 101, a network 102, and a server 103. The network 102 is used to provide a medium for a communication link between the terminal 101 and the server 103. The network 102 may include various types of wired communication links or wireless communication links, for example, the wired communication link includes an optical fiber, a twisted pair, or a coaxial cable, and the wireless communication link includes a Bluetooth communication link, a Wireless-Fidelity (Wi-Fi) communication link, or a microwave communication link.

[0051] The terminal 101 can interact with the server 103 through the network 102 to receive messages from the server 103 or send messages to the server 103, or the terminal 101 can interact with the server 103 through the network 102 to receive messages or data sent by other users to the server 103. The terminal 101 can be hardware or software. When the terminal 101 is hardware, it can be various terminals, including but not limited to smart watches, smart phones, tablet computers, laptop portable computers and desktop computers. When the terminal 101 is software, it can be installed in the terminals listed above, which can be implemented as multiple software or software modules (for example: used to provide distributed services), or it can be implemented as a single software or software module, which is not specifically limited here.

[0052] In an embodiment of the present application, the terminal 101 can generate a first pseudo-random number based on a pseudo-random number generation module in response to an operation of the target software to obtain a random number, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key; thereafter, a second pseudo-random number is generated again based on the pseudo-random number generation module, and the target file is decrypted based on the second pseudo-random number, and the second pseudo-random number is the same as the first pseudo-random number.

[0053] The server 103 may be a business server that provides various services. It should be noted that the server 103 may be hardware or software. When the server 103 is hardware, it may be implemented as a distributed server cluster consisting of multiple servers, or it may be implemented as a single server. When the server 103 is software, it may be implemented as multiple software or software modules (for example, for providing distributed services), or it may be implemented as a single software or software module, which is not specifically limited here.

[0054] Alternatively, the system architecture may not include the server 103. In other words, the server 103 may be an optional device in the embodiments of this specification. That is, the method provided in the embodiments of this specification may be applied to a system structure that only includes the terminal 101, and the embodiments of this application are not limited to this.

[0055] It should be understood that Figure 1The number of terminals, networks and servers in the figure is only for illustration and any number of terminals, networks and servers may be used according to implementation requirements.

[0056] See also Figure 2 , Figure 2 A flowchart of a ransomware prevention method provided for an embodiment of the present application. The execution subject of the embodiment of the present application can be a terminal that executes the ransomware prevention method, or a processor in the terminal that executes the ransomware prevention method, or a ransomware prevention service in the terminal that executes the ransomware prevention method. For the convenience of description, the specific execution process of the ransomware prevention method is introduced below by taking the execution subject as the processor in the terminal as an example.

[0057] S202: In response to the target software acquiring a random number, a first pseudo-random number is generated based on a pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key.

[0058] The target software includes but is not limited to ransomware, and may also include software that does not have permission to obtain random numbers. The pseudo-random number generation module may generate a preset number of first pseudo-random numbers within a determined range, but in response to the operation of the target software to obtain a random number, the pseudo-random number generation module may generate one or more of the preset number of first pseudo-random numbers within a determined range for the target software to obtain. After obtaining the first pseudo-random number, the target software processes the first pseudo-random number to generate a key, and encrypts the target file based on the key.

[0059] In a feasible implementation, when the target software is detected to obtain a random number, the target program is intercepted from calling the following random number generation functions or random number generation instructions, including the following CPU random number generation instructions: rdrand, rdseed, rdtsc; the following random number generation function API interfaces: CryptGenRandom, CryptGenKey, GenerateKey, GenerateIV, Crypto / rand / read, TickCount, UuidCreate; and the encryption library random number generation function API (Application Programming Interface) interface: RandomNumber Generator, BCryptGenRandom, etc. At the same time, the interface of the random number generation module connected to the target software is replaced with the interface of the pseudo-random number generation module, so that the target software can obtain the first pseudo-random number from the pseudo-random number generation module.

[0060] S204: Generate a second pseudo-random number again based on the pseudo-random number generation module, and decrypt the target file based on the second pseudo-random number, where the second pseudo-random number is the same as the first pseudo-random number.

[0061] Among them, since the pseudo-random number generation module can generate a preset number of first pseudo-random numbers within a determined range, the second pseudo-random number generated again also belongs to the range, that is, the first pseudo-random number and the second pseudo-random number generated based on the pseudo-random number generation module are both within the preset range.

[0062] The target file is decrypted by sequentially generating second pseudo-random numbers, and when the decryption fails, the next second pseudo-random number is generated again to decrypt the target file until the decryption succeeds. At this time, the second pseudo-random number is the same as the first pseudo-random number.

[0063] In a feasible implementation, when the second pseudo-random number is generated by the pseudo-random number generation module to decrypt the target file, the pseudo-random number generation module may generate the second pseudo-random number that can decrypt the target file once or multiple times. Generally, when the key of the target file is generated based on a single first pseudo-random number, the pseudo-random number generation module can generate the second pseudo-random number that can decrypt the target file from the first time to the preset number of times. Of course, when the preset number is Y, when the key of the target file is generated based on N first pseudo-random numbers, the pseudo-random number generation module can generate the second pseudo-random number that can decrypt the target file in the nth time, where n is less than or equal to A. n Y A positive integer greater than 0.

[0064] The embodiment of the present application provides a method for preventing and controlling ransomware, which generates a first pseudo-random number based on a pseudo-random number generation module in response to an operation of the target software to obtain a random number, so that the target software generates a key based on the first pseudo-random number and encrypts a target file based on the key; then, a second pseudo-random number identical to the first pseudo-random number is generated again based on the pseudo-random number generation module, and the target file is decrypted using the second pseudo-random number. The embodiment of the present application changes the way the target software obtains random numbers, and generates a first pseudo-random number using a pseudo-random number generation module. Here, the first pseudo-random number can be generated again by the pseudo-random number generation module, that is, the first pseudo-random number and the second pseudo-random number are both generated within a preset range, so that the target file encrypted by the key generated by the first pseudo-random number can be easily cracked, thereby solving the technical problem that the ransomware encrypts the user's files and makes the encrypted files technically impossible to crack.

[0065] In an embodiment provided in the embodiments of the present application, generating a first pseudo-random number based on a pseudo-random number generation module in step S202 includes:

[0066] A first pseudo-random number is generated based on a pseudo-random number generation module using at least one of machine code information and time information of a running terminal of the target software.

[0067] Among them, the machine code information of the target software running terminal includes an identification code corresponding to the target software running terminal, and the identification code may include at least one of letters and numbers. The machine code information is generally taken from the serial number of the hardware corresponding to the target software running terminal, and these hardware may include a hard disk, a motherboard or a CPU (central processing unit). Since the machine code information is usually only known to the user of the terminal, it is difficult for the ransomware attacker to obtain the machine code information of the terminal. Therefore, the ransomware attacker will not obtain the first pseudo-random number to prevent the ransomware attacker from conducting further attacks.

[0068] Furthermore, since the time information of the terminal running the target software changes in real time, the first pseudo-random numbers generated at different times can be different based on the real-time changing time information, and the time information is within a certain range.

[0069] If the current time is converted into hours, the time information will change between integers between 0 and 24; if the current time is converted into minutes, the time information will change between integers between 0 and 1440; if the current time is converted into seconds, there are 86400 seconds in a day, and the time information will change between integers between 0 and 86400.

[0070] Since the range of the machine code information of the target software running terminal is determined, and the range of the time information of the target software running terminal is determined, the range of the first pseudo-random number generated by the pseudo-random number generation module using at least one of the machine code information and the time information of the target software running terminal is also determined. It should be noted that the first pseudo-random number can be generated based on the machine code information or the time information alone, and preferably, the first pseudo-random number can also be generated based on both the machine code information and the time information.

[0071] The first pseudo-random number generated in this embodiment can also be regenerated based on the pseudo-random number generation module using at least one of the machine code information and time information of the running terminal of the target software, so as to realize decryption of the target file using the second pseudo-random number.

[0072] In an embodiment provided in an embodiment of the present application, generating a first pseudo-random number based on a pseudo-random number generation module using at least one of machine code information and time information of a running terminal of target software includes:

[0073] The target number of times the target software obtains random numbers is recorded, and at least one of the machine code information and time information of the running terminal of the target software and the target number are encrypting based on the pseudo-random number generation module to generate a first pseudo-random number.

[0074] Among them, the target software can obtain random numbers multiple times to generate keys. Since the processing speed of the terminal processor is relatively fast, the random numbers obtained by the target software multiple times may be generated at the same time point, for example, within the same second, the same minute, and the same hour, etc. At this time, the first pseudo-random numbers generated based on the time information or based on both the machine code information and the time information may be the same, which will generate multiple identical first pseudo-random numbers, reducing the security of the key generated based on multiple identical first pseudo-random numbers.

[0075] Therefore, the random number obtained each time is made different through the target number of times to improve the security level of the first pseudo-random number generated based on the time information or based on both the machine code information and the time information, thereby improving the security level of the key generated based on multiple first pseudo-random numbers.

[0076] Methods for encrypting at least one of the machine code information and time information of the target software's running terminal and the target number based on the pseudo-random number generation module include but are not limited to encryption using a hash algorithm. Due to the characteristics of the hash algorithm, when a remote attacker intercepts one or more groups of first pseudo-random numbers, it is difficult to reversely deduce the machine code information through the first pseudo-random numbers or know that the first pseudo-random numbers are obtained based on the time information, and it is also difficult to predict the results of subsequent first pseudo-random numbers.

[0077] The first pseudo-random number generated in this embodiment can also be regenerated based on the pseudo-random number generation module by encrypting at least one of the machine code information and time information of the running terminal of the target software and the target number of times, so as to decrypt the target file using the second pseudo-random number.

[0078] In a feasible implementation, the first pseudo-random number may be a hash value corresponding to (machine code information+time information (second level)+target number of times).

[0079] In another feasible implementation, the first pseudo-random number may be [time information (second level) + hash (machine code information + time information (second level) + target number of times) % maximum span] · adjustment ratio. Wherein, hash (machine code + time (second level) + target number of times) represents the hash value of (machine code + time (second level) + target number of times). The maximum span is a preset adjustment parameter, which may be 100 or 1000, etc., and is not limited here. The adjustment ratio may include but is not limited to performance parameters of the terminal, such as CPU main frequency, etc.

[0080] In an embodiment provided in the embodiment of the present application, in step S202, the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key, including:

[0081] So that the target software generates an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and encrypts the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

[0082] The target software generates a matching encryption public key and decryption private key based on the first pseudo-random number, and the file encrypted by the encryption public key can generally only be decrypted by the decryption private key.

[0083] Generally, when the target software is ransomware, after generating a decryption private key corresponding to the encryption public key, the ransomware will use the encryption public key to encrypt the decryption private key again and destroy the encrypted file so that the user cannot technically crack the decryption private key.

[0084] In an embodiment provided in the present application, decrypting the target file based on the second pseudo-random number in step S204 includes:

[0085] A decryption private key is generated based on the second target pseudo-random number, and the target file is decrypted based on the decryption private key.

[0086] Here, the second target pseudo-random number can be obtained by generating random numbers once or multiple times by the pseudo-random number generation module, that is, the second target pseudo-random number can be obtained by the pseudo-random number generation module using an exhaustive method. The second target pseudo-random number is converted into a decryption private key, and then the target file is decrypted using the decryption private key. In this way, the target file encrypted by the ransomware is cracked.

[0087] In an embodiment provided in the embodiment of the present application, before the operation of obtaining a random number in response to the target software in step S202, the following is further included:

[0088] Establish a software blacklist;

[0089] In response to the target software obtaining a random number operation, the operation includes:

[0090] If the operation of obtaining a random number is monitored and it is determined that the software corresponding to the operation of obtaining a random number belongs to the software blacklist, the software corresponding to the operation of obtaining a random number is determined to be the target software and the operation of obtaining a random number is responded to by the target software.

[0091] A software blacklist is established based on ransomware and software that does not have permission to obtain random numbers. When the software that obtains random numbers is on the software blacklist, the software corresponding to the operation of obtaining random numbers is used as the target software.

[0092] Here, the software blacklist can be updated. When the software corresponding to the operation of obtaining a random number is unknown software, that is, the unknown software is not on the software blacklist, nor on other pre-established lists, such as the software whitelist, when the running terminal of the unknown software is in a remote desktop environment, that is, it is remotely controlled, and the installation time of the unknown software on the terminal is less than a preset time period, the unknown software is included in the software blacklist to update the software blacklist. For example, if the first landing time of the unknown software on the terminal is less than 2 days, the unknown software is included in the software blacklist to update the software blacklist.

[0093] For another example, when the software corresponding to the operation of obtaining a random number is unknown software, that is, the unknown software is not on the software blacklist or other pre-established lists, the unknown software is downloaded through the network or copied from a removable storage medium, enters the running terminal of the unknown software, and the installation time of the unknown software on the running terminal of the unknown software is less than a preset time period, then the unknown software is included in the software blacklist to update the software blacklist. For example, if the first landing time of the unknown software on the terminal is less than 3 days, then the unknown software is included in the software blacklist to update the software blacklist.

[0094] Alternatively, when the software corresponding to the operation of obtaining a random number is unknown software, that is, the unknown software is not on the software blacklist or other pre-established lists, and the unknown software is located in a removable storage medium, the unknown software is included in the software blacklist to update the software blacklist.

[0095] In an embodiment provided in the embodiment of the present application, after establishing the software blacklist, the method further includes:

[0096] Create a software whitelist;

[0097] The method also includes:

[0098] In response to the operation of the whitelist software in the software whitelist acquiring a random number, based on the target true random number generated by the random number generation module, the whitelist software performs a target operation based on the target true random number.

[0099] Among them, the whitelist software in the software whitelist can normally obtain the target true random number and perform the target operation corresponding to the whitelist software based on the target true random number. Common examples include dice-rolling software and random roll-call software.

[0100] Here, the software whitelist can be updated. When the software corresponding to the operation of obtaining a random number is unknown software, that is, the unknown software is not on the software blacklist or the software whitelist, and when the running terminal of the unknown software is in a remote desktop environment, that is, it is remotely controlled, and the installation time of the unknown software on the terminal is greater than or equal to the preset time period, the unknown software is included in the software whitelist to update the software whitelist. For example, if the first landing time of the unknown software on the terminal is greater than or equal to 2 days, the unknown software is included in the software whitelist to update the software whitelist.

[0101] For another example, when the software corresponding to the operation of obtaining a random number is unknown software, that is, the unknown software is not on the software blacklist or the software whitelist, the unknown software is downloaded from the network or copied from a removable storage medium to enter the running terminal of the unknown software, and the installation time of the unknown software on the running terminal of the unknown software is greater than or equal to a preset time period, then the unknown software is included in the software whitelist to update the software whitelist. For example, if the first landing time of the unknown software on the terminal is greater than or equal to 3 days, then the unknown software is included in the software whitelist to update the software whitelist.

[0102] Figure 3 A schematic diagram of obtaining a target true random number based on whitelist software in a software whitelist is provided in an embodiment of the present application. Figure 4 A schematic diagram of obtaining a first pseudo-random number based on target software in a software blacklist provided in an embodiment of the present application.

[0103] like Figure 3 and Figure 4 As shown, by changing the API interfaces called by the whitelist software and the target software, the whitelist software calls the random number generation module based on the first API interface, and the target software calls the pseudo-random number generation module based on the second API interface.

[0104] An embodiment of the present application further provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded by a processor and executing the steps of any method in the above embodiments.

[0105] Figure 5 A schematic diagram of the structure of a ransomware prevention and control device provided in an embodiment of the present application. Figure 5 shown.

[0106] The ransomware prevention and control device 500 includes:

[0107] The response module 510 is adapted to generate a first pseudo-random number based on the pseudo-random number generation module in response to the operation of the target software to obtain a random number, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0108] The decryption module 520 is adapted to generate a second pseudo-random number again based on the pseudo-random number generation module, and decrypt the target file based on the second pseudo-random number, where the second pseudo-random number is the same as the first pseudo-random number.

[0109] In an embodiment provided in the present application, the response module 510 is further adapted to generate a first pseudo-random number based on the pseudo-random number generation module using at least one of machine code information and time information of the running terminal of the target software.

[0110] In an embodiment provided in the present application, the response module 510 is also suitable for recording the target number of times the target software obtains the random number, and based on the pseudo-random number generation module, encrypting at least one of the machine code information and time information of the running terminal of the target software and the target number of times to generate a first pseudo-random number.

[0111] In an embodiment provided in the present application, the response module 510 is also suitable for enabling the target software to generate an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and to encrypt the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

[0112] In an embodiment provided in the present application, the decryption module 520 is adapted to generate the decryption private key based on the second target pseudo-random number, and decrypt the target file based on the decryption private key.

[0113] In an embodiment provided in the present application, the ransomware prevention and control device 500 includes a software blacklist establishment module, which is suitable for establishing a software blacklist; the response module 510 is suitable for, if an operation of obtaining a random number is monitored, and it is determined that the software corresponding to the operation of obtaining a random number belongs to the software blacklist, determining that the software corresponding to the operation of obtaining a random number is the target software and responding to the operation of obtaining a random number by the target software.

[0114] In an embodiment provided in the present application, the ransomware prevention and control device 500 includes a software whitelist establishment module, which is suitable for establishing a software whitelist; the ransomware prevention and control device 500 also includes a whitelist response module, which is suitable for responding to the operation of the whitelist software in the software whitelist to obtain a random number, based on the target true random number generated by the random number generation module, so that the whitelist software performs a target operation based on the target true random number.

[0115] See also Figure 6 , Figure 6 A schematic diagram of the structure of a ransomware prevention terminal provided in an embodiment of the present application. Figure 6As shown, the data retrieval terminal 600 may include: at least one processor 601 , at least one network interface 604 , a user interface 603 , a memory 605 , and at least one communication bus 602 .

[0116] The communication bus 602 is used to realize the connection and communication between these components.

[0117] The user interface 603 may include a display screen (Display) and a camera (Camera), and the optional user interface 603 may also include a standard wired interface and a wireless interface.

[0118] The network interface 604 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0119] Among them, the processor 601 may include one or more processing cores. The processor 601 uses various interfaces and lines to connect the various parts of the entire experimental operation terminal 600, and executes various functions and processes data of the sample data management terminal 600 by running or executing instructions, programs, code sets or instruction sets stored in the memory 605, and calling data stored in the memory 605. Optionally, the processor 601 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 601 can integrate one or more combinations of a central processing unit (Central Processing Unit, CPU), a graphics processor (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communication. It can be understood that the above-mentioned modem may not be integrated into the processor 601, and it can be implemented by a single chip.

[0120] Among them, the memory 605 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory, ROM). Optionally, the memory 605 includes a non-transitory computer-readable storage medium. The memory 605 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 605 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 605 may also be optionally at least one storage device located away from the aforementioned processor 601. As Figure 6 As shown, the memory 605 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a ransomware prevention and control program.

[0121] exist Figure 6 In the data retrieval terminal 600 shown, the user interface 603 is mainly used to provide an input interface for the user to obtain the data input by the user; and the processor 601 can be used to call the ransomware prevention program stored in the memory 605, and specifically perform the following operations:

[0122] In response to the target software obtaining a random number, generating a first pseudo-random number based on a pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0123] A second pseudo-random number is generated again based on the pseudo-random number generation module, and the target file is decrypted based on the second pseudo-random number, where the second pseudo-random number is the same as the first pseudo-random number.

[0124] In some embodiments, when the processor 601 generates a first pseudo-random number based on the pseudo-random number generation module, the following steps are included:

[0125] A first pseudo-random number is generated based on a pseudo-random number generation module using at least one of machine code information and time information of a running terminal of the target software.

[0126] In some embodiments, when the processor 601 generates a first pseudo-random number based on the pseudo-random number generation module using at least one of the machine code information and the time information of the running terminal of the target software, the following steps are included:

[0127] The target number of times the target software obtains random numbers is recorded, and at least one of the machine code information and time information of the running terminal of the target software and the target number are encrypting based on the pseudo-random number generation module to generate a first pseudo-random number.

[0128] In some embodiments, when the processor 601 executes so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key, the following steps are included:

[0129] So that the target software generates an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and encrypts the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

[0130] In some embodiments, the processor 601 performs decryption of the target file based on the second pseudo-random number, including the following steps:

[0131] A decryption private key is generated based on the second target pseudo-random number, and the target file is decrypted based on the decryption private key.

[0132] In some embodiments, before the processor 601 executes the operation of obtaining a random number in response to the target software, the processor 601 further executes:

[0133] Establish a software blacklist;

[0134] In response to the target software obtaining a random number operation, the operation includes:

[0135] If the operation of obtaining a random number is monitored and it is determined that the software corresponding to the operation of obtaining a random number belongs to the software blacklist, the software corresponding to the operation of obtaining a random number is determined to be the target software and the operation of obtaining a random number is responded to by the target software.

[0136] In some embodiments, after establishing the software blacklist, the processor 601 further executes:

[0137] Create a software whitelist;

[0138] The method also includes:

[0139] In response to the operation of the whitelist software in the software whitelist acquiring a random number, based on the target true random number generated by the random number generation module, the whitelist software performs a target operation based on the target true random number.

[0140] In the several embodiments provided in the embodiments of the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0141] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules.

[0143] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0144] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of the present application.

[0145] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0146] The above is a description of a ransomware prevention and control method, device, terminal, and computer-readable storage medium provided in an embodiment of the present application. For those skilled in the art, according to the ideas of the embodiments of the present application, there may be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the embodiments of the present application.

[0147] The embodiment of the present invention discloses A1, a method for preventing and controlling ransomware, wherein the method comprises:

[0148] In response to the target software obtaining a random number, generating a first pseudo-random number based on a pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0149] A second pseudo-random number is generated again based on the pseudo-random number generation module, and the target file is decrypted based on the second pseudo-random number, where the second pseudo-random number is the same as the first pseudo-random number.

[0150] A2. The ransomware prevention and control method as described in A1, wherein generating a first pseudo-random number based on a pseudo-random number generation module comprises:

[0151] A first pseudo-random number is generated based on a pseudo-random number generation module using at least one of machine code information and time information of a running terminal of the target software.

[0152] A3. The ransomware prevention and control method as described in A2, wherein the first pseudo-random number is generated based on the pseudo-random number generation module using at least one of the machine code information and time information of the running terminal of the target software, including:

[0153] The target number of times the target software obtains random numbers is recorded, and at least one of the machine code information and time information of the running terminal of the target software and the target number are encrypting based on the pseudo-random number generation module to generate a first pseudo-random number.

[0154] A4. The ransomware prevention and control method as described in any one of A2 to A3, wherein the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key, comprising:

[0155] So that the target software generates an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and encrypts the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

[0156] A5. The ransomware prevention and control method as described in A4, wherein decrypting the target file based on the second pseudo-random number comprises:

[0157] A decryption private key is generated based on the second target pseudo-random number, and the target file is decrypted based on the decryption private key.

[0158] A6. The ransomware prevention and control method as described in A1, wherein before responding to the operation of obtaining a random number by the target software, the method further comprises:

[0159] Establish a software blacklist;

[0160] In response to the target software obtaining a random number operation, the operation includes:

[0161] If the operation of obtaining a random number is monitored and it is determined that the software corresponding to the operation of obtaining a random number belongs to the software blacklist, the software corresponding to the operation of obtaining a random number is determined to be the target software and the operation of obtaining a random number is responded to by the target software.

[0162] A7. The ransomware prevention and control method as described in A6, wherein after establishing the software blacklist, the method further comprises:

[0163] Create a software whitelist;

[0164] The method also includes:

[0165] In response to the operation of the whitelist software in the software whitelist acquiring a random number, based on the target true random number generated by the random number generation module, the whitelist software performs a target operation based on the target true random number.

[0166] The embodiment of the present invention further discloses B8, a ransomware prevention and control device, wherein the device comprises:

[0167] A response module, adapted to generate a first pseudo-random number based on the pseudo-random number generation module in response to an operation of the target software to obtain a random number, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0168] The decryption module is adapted to generate a second pseudo-random number again based on the pseudo-random number generation module, and decrypt the target file based on the second pseudo-random number, where the second pseudo-random number is the same as the first pseudo-random number.

[0169] B9. The ransomware prevention and control device as described in B8, wherein the response module is further adapted to generate a first pseudo-random number based on the pseudo-random number generation module using at least one of machine code information and time information of the running terminal of the target software.

[0170] B10. The ransomware prevention and control device as described in B9, wherein the response module is further adapted to record a target number of times the target software obtains a random number, and based on the pseudo-random number generation module, encrypt at least one of the machine code information and the time information of the running terminal of the target software and the target number of times to generate a first pseudo-random number.

[0171] B11. A ransomware prevention and control device as described in B8 or B9, wherein the response module is further adapted to enable the target software to generate an encryption public key and a decryption private key corresponding to the encryption public key based on a first pseudo-random number, and to encrypt a target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

[0172] B12. The ransomware prevention and control device as described in B11, wherein the decryption module is suitable for generating a decryption private key based on the second target pseudo-random number, and decrypting the target file based on the decryption private key.

[0173] B13. The ransomware prevention and control device as described in B8, wherein the ransomware prevention and control device includes a software blacklist establishment module, the software blacklist establishment module is suitable for establishing a software blacklist; the response module is suitable for, if an operation of obtaining a random number is monitored, and it is determined that the software corresponding to the operation of obtaining a random number belongs to the software blacklist, determining that the software corresponding to the operation of obtaining a random number is the target software and responding to the operation of obtaining a random number by the target software.

[0174] B14. The ransomware prevention and control device as described in B13, wherein the ransomware prevention and control device includes a software whitelist establishment module, which is suitable for establishing a software whitelist; the ransomware prevention and control device also includes a whitelist response module, which is suitable for responding to the operation of the whitelist software in the software whitelist to obtain a random number, based on the target true random number generated by the random number generation module, so that the whitelist software performs a target operation based on the target true random number.

[0175] C15. A terminal, wherein the terminal comprises:

[0176] Processor; and

[0177] A memory arranged to store computer executable instructions which, when executed, cause a processor to perform a method according to any one of A1 to A7.

[0178] D16. A computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, they implement any method of A1 to A7.

Claims

1. A method for preventing and controlling ransomware, wherein: The method comprises: In response to the operation of the target software acquiring a random number, generating a first pseudo-random number based on a pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key; A second pseudo-random number is generated again based on the pseudo-random number generation module, and the target file is decrypted based on the second pseudo-random number, where the second pseudo-random number is the same as the first pseudo-random number.

2. The method for preventing and controlling ransomware according to claim 1, wherein: The generating a first pseudo-random number based on a pseudo-random number generating module comprises: A first pseudo-random number is generated based on the pseudo-random number generation module using at least one of the machine code information and the time information of the running terminal of the target software.

3. The ransomware prevention and control method according to claim 2, wherein: The generating a first pseudo-random number based on the pseudo-random number generating module using at least one of the machine code information and the time information of the running terminal of the target software comprises: The target number of times the target software obtains the random number is recorded, and at least one of the machine code information and the time information of the running terminal of the target software and the target number are encrypting based on the pseudo-random number generation module to generate a first pseudo-random number.

4. The ransomware prevention and control method according to any one of claims 2 to 3, wherein: The method of causing the target software to generate a key based on the first pseudo-random number and encrypt the target file based on the key includes: So that the target software generates an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and encrypts the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

5. The method for preventing and controlling ransomware according to claim 4, wherein: The decrypting the target file based on the second pseudo-random number includes: The decryption private key is generated based on the second target pseudo-random number, and the target file is decrypted based on the decryption private key.

6. The ransomware prevention and control method according to claim 1, wherein: Before the operation of obtaining a random number in response to the target software, the method further includes: Establish a software blacklist; The operation of obtaining a random number in response to the target software includes: If the operation of obtaining a random number is monitored, and it is determined that the software corresponding to the operation of obtaining a random number belongs to the software blacklist, the software corresponding to the operation of obtaining a random number is determined to be the target software and the operation of obtaining a random number is responded to by the target software.

7. The method for preventing and controlling ransomware according to claim 6, wherein: After the software blacklist is established, the following steps are also included: Create a software whitelist; The method further comprises: In response to the operation of the whitelist software in the software whitelist acquiring a random number, based on the target true random number generated by the random number generation module, the whitelist software performs a target operation based on the target true random number.

8. A ransomware prevention and control device, wherein: The device comprises: a response module, adapted to generate a first pseudo-random number based on a pseudo-random number generation module in response to an operation of the target software to obtain a random number, so that the target software generates a key based on the first pseudo-random number and encrypts a target file based on the key; The decryption module is adapted to generate a second pseudo-random number again based on the pseudo-random number generation module, and decrypt the target file based on the second pseudo-random number, wherein the second pseudo-random number is the same as the first pseudo-random number.

9. A terminal, wherein: The terminal includes: Processor; and A memory arranged to store computer executable instructions which, when executed, cause the processor to perform a method according to any one of claims 1 to 7.

10. A computer-readable storage medium, wherein: The computer-readable storage medium stores one or more programs, which, when executed by a processor, implement the method of any one of claims 1 to 7.

Images